feat(operability): aggregate bounded control-plane SLI receipts across review and maintenance runs

[seonghobae]

Buyer/operator gap

The canonical automation documentation now defines protected-main acceptance and queue/review/repair SLO concepts, but evidence is still distributed across GitHub run/job/check/review records. Operators cannot answer from one bounded receipt whether the control plane is accumulating executable-lane age, reviewer backlog, provider retry exhaustion, writer collisions, merge latency, or post-merge acceptance debt without reconstructing multiple APIs manually.

Scope

Add a read-only, finite-cardinality receipt aggregator for the central control plane. It must not create a new authority class or persistent database by implication.

Minimum dimensions/metrics:

• repository and protected base branch (bounded exact identifiers);
• exact source head and workflow/run/attempt identity where applicable;
• oldest executable-lane age;
• deferred-lane age by finite reason code;
• check/review/provider wait counts by finite class;
• transient retry attempts/exhaustions by failure class;
• branch-local writer collisions avoided;
• gate-clean → protected-merge latency;
• protected-merge → operational-acceptance latency/debt;
• META_INTERMEDIATE followed by substantive action count;
• first-exit-sweep work-discovery count; and
• RUN_BUDGET_EXHAUSTED continuation handoff count.

Security/privacy boundary

Never put source text, comment bodies, PR titles, model output, raw logs, PII, tokens, URLs with secrets, arbitrary exception text, or unbounded user-controlled values into metric labels/keys. The collector is read-only and does not approve, merge, retry, dispatch, or mutate branches.

Architecture constraints

• Reuse the evidence classes and reason codes in docs/automation/DATA_MODEL.md, CONTINUATION_RUNBOOK.md, and EVENT_CONTRACTS.md after the canonical docs baseline lands.
• Preserve check/status/review/model/workflow authority separation.
• GitHub remains source of truth; any materialized history/cache requires a separate persistence ADR.
• Prefer OpenTelemetry-compatible bounded metric/log receipt shapes, but do not claim OTel conformance without an exact schema/test.
• Missing permissions or incomplete evidence must yield explicit unknown/not_observed states, never inferred success.

Test-first acceptance

1. Add RED tests for finite-cardinality normalization, hostile/user-controlled strings, missing/duplicate/stale evidence, exact-head separation, and authority non-conflation.
2. Implement one pure/read-only normalizer/aggregator with 100% owned production statement/branch coverage and public docstrings.
3. Add a fixture representing at least two repositories, a pending review, a transient provider exhaustion, a moved head, one successful merge, and one pending operational acceptance.
4. Emit versioned bounded JSON suitable for a workflow artifact/step summary; no new database.
5. Add an opt-in or read-only central workflow that collects the receipt without model or merge credentials.
6. Verify Python 3.14, full central suite, security checks, schema/version compatibility, and git diff --check.
7. Update Operability/Traceability and APA 7 doctoring for any new external specification used.

This issue is a product/control-plane implementation gap discovered by the whole-conversation documentation audit; it is not evidence that the documentation family itself is incomplete.